registry / Staged payload carrier / @agent-qofeno/agentx-cli / 3.0.4

@agent-qofeno/agentx-cli@3.0.4

To install dependencies:

AI Security Review

scanned 15d ago · by lpm-firewall-ai

The postinstall creates an integrity-unverified executable delivery path, but the source points to the package's own release and does not show an active attack. This supports a warning for a staged payload carrier, not a block.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm installation on a supported platform when the target binary is absent.

Impact

A compromised or substituted release archive could supply executable code that runs when the CLI is invoked.

Mechanism

The postinstall fetches a fixed release archive, extracts it with tar, and copies the executable into bin.

AI rationale

Evidence

package.jsonbin/postinstall.mjsbin/agentx

Network endpoints1

github.com/SohailKhan0525/agentxcode/releases/download/v3.0.1/

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

package.json runs bin/postinstall.mjs automatically during installation.
The postinstall downloads a platform binary archive from the package's GitHub release URL.
The script extracts the archive and copies the resulting executable into the package's bin directory without verifying its integrity.

Evidence against

The downloaded binary is hosted at the package's own GitHub release location; inspected source does not establish malicious payload behavior.
The reported LSP command output is used to locate the local sourcekit-lsp executable, with no external send shown in the inspected excerpt.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

Source & flagged code

7 flagged

package.jsonView file

Lines 2-43json

2 "$schema": "https://json.schemastore.org/package.json",

3 "version": "3.0.4",

4 "name": "@agent-qofeno/agentx-cli",

5 "type": "module",

6 "license": "MIT",

7 "private": false,

8 "repository": {

9 "type": "git",

10 "url": "https://github.com/SohailKhan0525/agentxcode.git"

11 },

12 "homepage": "https://github.com/SohailKhan0525/agentxcode#readme",

13 "bugs": {

14 "url": "https://github.com/SohailKhan0525/agentxcode/issues"

15 },

16 "files": [

17 "bin",

18 "src",

19 "migration",

20 "README.md"

21 ],

22 "scripts": {

23 "postinstall": "node ./bin/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 "typecheck": "tsgo --noEmit",

25 "test": "bun test --timeout 30000 --only-failures",

26 "test:httpapi": "bun run script/httpapi-exercise.ts --mode coverage --fail-on-missing --fail-on-skip && bun run script/httpapi-exercise.ts --mode auth --fail-on-missing --fail-on-skip && bun run script/httpapi-exercise.ts --mode effect --fail-on-missing --fail-on-skip",

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L22

27 "bench:test": "bun run script/bench-test-suite.ts",

28 "profile:test": "bun run script/profile-test-files.ts",

29 "build": "bun run script/build.ts",

30 "dev": "bun run ./src/index.ts",

31 "dev:temporary": "bun run ./src/temporary.ts"

32 },

33 "bin": {

34 "agentx": "./bin/agentx",

35 "opencode": "./bin/agentx"

36 },

37 "exports": {

38 "./*": "./src/*.ts"

39 },

40 "imports": {

41 "#db": {

42 "bun": "./src/storage/db.bun.ts",

43 "node": "./src/storage/db.node.ts",

bin/postinstall.mjsView file

Lines 1-25javascript

1#!/usr/bin/env node

3import fs from "node:fs"

4import path from "node:path"

5import os from "node:os"

6import childProcess from "node:child_process"

src/config/config.tsView file

Lines 258-298typescript

258 })

259

260 const loadGlobal = Effect.fnUntraced(function* (env?: Record<string, string>) {

261 let result

src/lsp/server.tsView file

Lines 1-21typescript

1import type { ChildProcessWithoutNullStreams } from "child_process"

2import path from "path"

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/lsp/server.tsView on unpkg · L1

3import os from "os"

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

22scripts.postinstall = node ./bin/postinstall.mjs Install-time code downloads an unverified remote native archive, stages it locally, activates an executable path, and exposes it to process execution. L22: const exeExt = isWin ? ".exe" : "" L23: const targetBinary = path.join(scriptDir, "agentx" + exeExt) L24: L25: if (fs.existsSync(targetBinary)) { L26: process.exit(0) ... L48: const releaseTag = "v3.0.1" L49: const archiveExt = isWin ? ".zip" : ".tar.gz" L50: const archiveName = `agentx-${platform}-${arch}${archiveExt}` L51: const downloadUrl = `https://github.[redacted]/${releaseTag}/${archiveName}` L52: ... L57: try { L58: const res = await fetch(downloadUrl, { redirect: "follow" })

High

Unverified Remote Native Payload Install

Install-time source downloads a native archive from a fixed external host without transport verification, extracts it, and installs an executable payload.

package.jsonView on unpkg · L22

•scripts.postinstall = node ./bin/postinstall.mjs

Medium

Findings

1 Critical5 High5 Medium5 Low

CriticalCommand Output Exfiltrationsrc/lsp/server.ts

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/postinstall.mjs

HighShell

HighUnverified Remote Native Payload Installpackage.json

HighSandbox Evasion Gated Capabilitysrc/lsp/server.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiresrc/config/config.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

Low

Affected versions and remediation

This report applies to @agent-qofeno/agentx-cli@3.0.4.

See all versions of @agent-qofeno/agentx-cli for other recorded verdicts.

Review the evidence and your use of @agent-qofeno/agentx-cli@3.0.4 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-10-07 22:52:02.203Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.